Merge pull request #493 from betrusted-io/refactor-sha2

Refactor sha2

Cargo.toml

@@ -17,7 +17,7 @@ default-members = [
   "services/shellchat",
   "services/llio",
   "services/codec",
-  "services/engine-sha512",
+  #  "services/engine-sha512",
   "services/engine-25519",
   "services/aes",
   "services/spinor",
@@ -60,7 +60,7 @@ members = [
   "services/content-plugin-api",
   "services/llio",
   "services/codec",
-  "services/engine-sha512",
+  #  "services/engine-sha512",
   "services/engine-25519",
   "services/aes",
   "services/spinor",
@@ -135,8 +135,9 @@ incremental = true
 opt-level = "s" # z,s: Optimize for size instead of performance; 1 for easier debugging; comment out for "best performance" (but in Rust 1.72 this causes regressions)
 
 # prefer hardware-accelerated versions of services
-[patch.crates-io.sha2]
-path = "services/engine-sha512"
+[patch.crates-io]
+sha2 = { git = "https://github.com/betrusted-io/hashes.git", branch = "sha2-v0.10.8-xous" }
+sha2_legacy = { git = "https://github.com/RustCrypto/hashes.git", tag = "sha2-v0.9.9", package = "sha2" }
 
 [patch.crates-io.aes]
 path = "services/aes"

RELEASE-v0.9.md

@@ -466,6 +466,7 @@ perform the Xous firmware upgrade. This requires running manual update commands,
 - Formatting and contribution standards have been modified. Formatting with `rustfmt` and trailing white space removal is now mandatory for all Xous contributions, see [#477](https://github.com/betrusted-io/xous-core/pull/477) for a discussion of how we got there and why.
 - The repo has gone through a "flag day" where all the crates have been formatted, which means commits before the flag day may be more difficult to undo. The changes are committed on a crate-by-crate basis, so if something is really broken we can undo the formatting for the crate and add an exception to the rustfmt rules.
 - Implement #478: backlight should turn on automatically when a U2F/FIDO packet comes in from the host, allowing users in dark conditions to see the screen and know what they are approving.
+- the `sha2` API has been upgraded from 0.9.9 to 0.10.8. In the process of upgrading this, the `sha2` code is now domiciled in a fork of the `RustCrypto/hashes` repo. This should hopefully make tracking changes on RustCrypto somewhat easier, at the price of some difficulty in maintaining external crate pins (but I think that can be solved with some scripting). In the process of conversion, crates that depend on the 0.9.9 API for acceleration are now not accelerated. In particular, the ed25519-dalek signature check on the gateware at boot now runs with software SHA-512, which means that boot is much slower. This should be fixed before the release is live, but users testing the bleeding edge should be aware of this temporary regression in performance.
 
 
 ## Roadmap

apps/vault/Cargo.toml

@@ -49,11 +49,11 @@ chrono = { version = "0.4.19", default-features = false, features = ["std"] }
 passwords = "3.1.9"
 
 # totp
-sha-1 = "0.9.8"
-hmac = "0.11.0"
+sha1 = "0.10.6"
+hmac = "0.12.1"
 digest = "0.9.0"
 base32 = "0.4.0"
-sha2 = { path = "../../services/engine-sha512" }
+sha2 = { version = "0.10.8" }
 sntpc = { version = "0.3.1" }
 net = { path = "../../services/net" }
 com_rs = { git = "https://github.com/betrusted-io/com_rs", rev = "891bdd3ca8e41f81510d112483e178aea3e3a921" }

apps/vault/libraries/crypto/Cargo.toml

@@ -12,14 +12,18 @@ edition = "2018"
 [dependencies]
 cbor = { path = "../cbor" }
 arrayref = "0.3.6"
-subtle = { version = "2.2.3", default-features = false}
-trng = {path = "../../../../services/trng"}
-xous-names = {package = "xous-api-names", version = "0.9.55"}
+subtle = { version = "2.2.3", default-features = false }
+trng = { path = "../../../../services/trng" }
+xous-names = { package = "xous-api-names", version = "0.9.55" }
 rand_core = "0.6.3"
-p256 = {version = "0.10.1", default-features = false, features = ["ecdsa", "ecdh", "std"]}
+p256 = { version = "0.10.1", default-features = false, features = [
+  "ecdsa",
+  "ecdh",
+  "std",
+] }
 cbc = "0.1.2"
-aes = {path="../../../../services/aes"}
-sha2 = {path="../../../../services/engine-sha512"}
+aes = { path = "../../../../services/aes" }
+sha2 = { version = "0.10.8" }
 
 log = "0.4.14" # xous debugging
 
@@ -37,4 +41,4 @@ byteorder = { version = "1", default-features = false }
 rfc6979 = "0.2.0"
 
 [features]
-with_ctap1 = []
+with_ctap1 = []

apps/vault/src/totp.rs

@@ -5,7 +5,7 @@ use std::{
     time::{SystemTime, SystemTimeError},
 };
 
-use hmac::{Hmac, Mac, NewMac};
+use hmac::{Hmac, Mac};
 use num_traits::*;
 use sha1::Sha1;
 use xous::{send_message, Message};

libs/tls/Cargo.toml

@@ -22,7 +22,7 @@ pddb = { path = "../../services/pddb" }
 der = { version = "0.7.6", features = ["derive"] }
 locales = { path = "../../locales" }
 rkyv = "0.4.3"
-sha2 = "0.9.8"
+sha2 = { version = "0.10.8" }
 
 # note requirement for patch to xous-ring in workspace Cargo.toml
 rustls = { version = "0.21.7", features = ["dangerous_configuration"] }
@@ -33,3 +33,6 @@ x509-parser = "0.15.0"
 
 [features]
 rootCA = ["webpki-roots"]
+precursor = ["sha2/precursor"]
+hosted = ["sha2/hosted"]
+renode = ["sha2/renode"]